--- title: SentinelOne XDR Integration  description: "The SentinelOne Singularity is an XDR Platform that helps enterprises gain the visibility, analytics, and AI-driven automation they need to protect against known and unknown cyber threats.\n\nSentinelOne Singularity XDR unifies AI-powered prevention (EPP), endpoint detection and response (EDR), containers, network attack surface management, and cloud workload protection in a single, autonomous XDR platform." --- [Skip to content](https://content.sirp.io/knowledge-base/sentinelone-xdr-integration-help-center-sirp#main-content) English Show submenu for translations [Customer portal](https://content.sirp.io/customer-portal?hsLang=en) [![SIRP-Logo-4c-KO](https://content.sirp.io/hs-fs/hubfs/SIRP-Logo-4c-KO.png?width=200&height=90&name=SIRP-Logo-4c-KO.png)](https://sirp.io/) Open main navigation Close main navigation - English Show submenu for translations - [Customer portal](https://content.sirp.io/customer-portal) - [Contact us](https://content.sirp.io/customer-portal/new) [Contact us](https://content.sirp.io/customer-portal/new?hsLang=en) What would you like to automate today? - There are no suggestions because the search field is empty. 1. [SIRP Help Center](https://content.sirp.io/knowledge-base?hsLang=en) 2. [Integration Guide](https://content.sirp.io/knowledge-base/integration-guide?hsLang=en) # SentinelOne XDR Integration ### About SentinelOne XDR The SentinelOne Singularity is an XDR Platform that helps enterprises gain the visibility, analytics, and AI-driven automation they need to protect against known and unknown cyber threats. SentinelOne Singularity XDR unifies AI-powered prevention (EPP), endpoint detection and response (EDR), containers, network attack surface management, and cloud workload protection in a single, autonomous XDR platform. Together, SIRP and SentinelOne provide users with a single interface for quicker detection, investigation, and response. SIRP’s integration with SentinelOne Singularity XDR allows security teams to execute 700+ response actions across different security products. ### Supported Actions SIRP’s SentinelOne XDR integration app allows you to execute the following actions: | **S.no** | **Action** | **Description** | | --- | --- | --- | | 1 | Add blacklist item | Add hashes to blacklist in SentinelOne XDR | | 2 | Add threat to blacklist | Add threat to blacklist in SentinelOne XDR | | 3 | Broadcast message | Broadcast message with SentinelOne XDR | | 4 | Connect agent to network | Add new agent to network in SentinelOne XDR | | 5 | Disable agent | Disable agent on network in SentinelOne XDR | | 6 | Disconnect agent from network | Disconnect agent on network in SentinelOne XDR | | 7 | Enable agent | Enable agent on network in SentinelOne XDR | | 8 | Get alerts | Get new alerts from SentinelOne XDR | | 9 | Get agent applications | Get agent applications from SentinelOne XDR | | 10 | Get hash reputation | Get new hashes from SentinelOne XDR | | 11 | Get threats | Get threat feeds from SentinelOne XDR | | 12 | Initiate scan | Initiate scan on endpoints SentinelOne XDR | | 13 | Mark alert as false positive | Mark alert as "false positive" in SentinelOne XDR | | 14 | Mark alert as true positive | Mark alert as "true positive" in SentinelOne XDR | | 15 | Mark alert as undefined | Mark alert as "undefined" in SentinelOne XDR | | 16 | Mark alert incident status as in progress | Mark alert incident status as "in progress" in SentinelOne XDR | | 17 | Mark alert incident status as resolved | Mark alert incident status as "resolved" in SentinelOne XDR | | 18 | Mark alert incident status as unresolved | Mark alert incident status as "unresolved" in SentinelOne XDR | | 19 | Mark threat as false positive | Mark threat as "false positive" in SentinelOne XDR | | 20 | Mark threat as suspicious | Mark threat as "suspicious" in SentinelOne XDR | | 21 | Mark threat as true positive | Mark threat as "true positive" in SentinelOne XDR | | 22 | Mark threat as undefined | Mark threat as "undefined" in SentinelOne XDR | | 23 | Mark threat incident status as in progress | Mark threat incident status as "in progress" in SentinelOne XDR | | 24 | Mark threat incident status as resolved | Mark threat incident status as "resolved" in SentinelOne XDR | | 25 | Mark threat incident status as unresolved | Mark threat incident status as "unresolved" in SentinelOne XDR | | 26 | Validate sentinel item | Validate hashes in SentinelOne XDR | ### Enable and Configure SentinelOne XDR ### Create a new user on SentinelOne Instance - Log in to your SentinelOne Singularity XDR instance. - In the **Settings** tab from the dashboard, go to **Users.** [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/a8OaikfPhKsoO8NYdBOz7DRQ4PU4VSfL-Fnepf0p-Zmv79p96wZt6Lw__eXiMZ_2sMx7DTlap960dCrjVqBWAqMxLrIitejVuYaFONGQdpQ-A7s_apxmKEzSDpgwXA.png)](https://sirp.intercom-attachments-7.com/i/o/477938973/1219e8deb0232aaafb61b271/a8OaikfPhKsoO8NYdBOz7DRQ4PU4VSfL-Fnepf0p-Zmv79p96wZt6Lw__eXiMZ_2sMx7DTlap960dCrjVqBWAqMxLrIitejVuYaFONGQdpQ-A7s_apxmKEzSDpgwXA?expires=1752237000&signature=d8ffe690a0f56388f49147c5253129d06e53be4a552b7f59a1fa78ce885d9720&req=cCcgH8p2lIZcFb4f3HP0gGJFs6umEFG8DCWGlAFNuGc20rbyWFzQue0BR8Ck%0A5fUhMKKlXtzwUlNdkg%3D%3D%0A) - Create a **New user** and enter the **Full Name and Email** of the user. - Assign a **Role** to this new user. - Locate the **API Token** and click on **Generate.** [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/J4-A72GVuofBY4Wk6_yh4WIWHJiB4vHNJdSzhIjOLoyDbjuF7NjjkQFwCQaTnGgK8Cw-rnbSPAiixMjYlQKQQ-kdYBKku7q2ACqRpzqylvu1lRfE40PaFkgxyCNBlA.png)](https://sirp.intercom-attachments-7.com/i/o/477938979/82faeb8a2856d158df4bc8eb/J4-A72GVuofBY4Wk6_yh4WIWHJiB4vHNJdSzhIjOLoyDbjuF7NjjkQFwCQaTnGgK8Cw-rnbSPAiixMjYlQKQQ-kdYBKku7q2ACqRpzqylvu1lRfE40PaFkgxyCNBlA?expires=1752237000&signature=b6a68954022dd5f3813047bfe6e7982a05c5332bb42549534dff6715cf72d159&req=cCcgH8p2lIZWFb4f3HP0gGmg68gA45RthqZcshiGbXDod0eNDQWHcXmvKjSq%0AqLgWZaxvblup2Kqnwg%3D%3D%0A) ### Generate API Token on SentinelOne Instance A new window will be open with the token. **Copy** and **download** the token from this box to configure the SentinelOne XDR app within SIRP in the later steps. [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/rCWjV4yU8DtKRBdy6GCMqBaIXxxaQMW1pPrwYW2f0BJ4Jcb4BNT9Zm1QB0i59bL9HKBjZvg9y3bcB-YZ_EbyqnrSkUUma4X68RowYeEvp-K8fjBqrNPQHK74BqXtEQ.png)](https://sirp.intercom-attachments-7.com/i/o/477938986/75d6e4a1afa822b87ba51179/rCWjV4yU8DtKRBdy6GCMqBaIXxxaQMW1pPrwYW2f0BJ4Jcb4BNT9Zm1QB0i59bL9HKBjZvg9y3bcB-YZ_EbyqnrSkUUma4X68RowYeEvp-K8fjBqrNPQHK74BqXtEQ?expires=1752237000&signature=ef0ab7f9286cdd11c7421de3010852dbb3d5041925b1f9318b327538066cb6b7&req=cCcgH8p2lIlZFb4f3HP0gM7iDp7qdfkLABsu12uMTXMYKxREjQWheYBBRL6S%0AMThzghslSI2tyt%2FWVg%3D%3D%0A) ### Enable the SentinelOne XDR in SIRP - First, log in to SIRP, then go to **Apps** from the left navigation bar. - Locate the app named **SentinelOne XDR.** - **Enable** the SentinelOne XDR by clicking on the toggle button under the Status Column. [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/XNTK8ltlSqGGiWqqryV-3bC7ULg9G_bpO0ZnSIB7JS61WIXoRVlG9YHAcXV9AeBurZGU1VtM8coWVRmBxJ17ziP8z6rcWQY2pA0McdauZCgo-_OrAwehm2cwojOWXQ.png)](https://sirp.intercom-attachments-7.com/i/o/477938992/46af2b0e81e8b98222c666c0/XNTK8ltlSqGGiWqqryV-3bC7ULg9G_bpO0ZnSIB7JS61WIXoRVlG9YHAcXV9AeBurZGU1VtM8coWVRmBxJ17ziP8z6rcWQY2pA0McdauZCgo-_OrAwehm2cwojOWXQ?expires=1752237000&signature=8f1e7d30849e303a88c15eaf5c7ab9a1ed1040e5f32202ed48af577be7b36ed1&req=cCcgH8p2lIhdFb4f3HP0gPva%2FTUsl4PQvrn0FH19GUKyt0ZyBPUNbtSFUaqt%0AogyPxG9CdJHY7JFM0w%3D%3D%0A) - Once you enable the App, click the **configure** option to integrate SIRP with SentinelOne - Add the following details and click **Save**: 1. **Host:** \ 2. **Token**: \ 3. **Account ID:** \ 4. **Configuration Name:** \ [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/8kXQoAL7dcyeQEGIb-l9WMlNJIELnikEfUg8JanDu_T2kO1xuVR1DTDvYdzVY4jKZZqQlw3H9OKZ7ebzlw07YNTd1RHSgbQgPDLuIi6iauPDR6zbREt8UlL6zP9nFw.png)](https://sirp.intercom-attachments-7.com/i/o/477938996/323d1f0a40df2313b33d514f/8kXQoAL7dcyeQEGIb-l9WMlNJIELnikEfUg8JanDu_T2kO1xuVR1DTDvYdzVY4jKZZqQlw3H9OKZ7ebzlw07YNTd1RHSgbQgPDLuIi6iauPDR6zbREt8UlL6zP9nFw?expires=1752237000&signature=d1e2c9b40f184c7eff748a382b2d8cc37a31d08c74d315005d3e738d6a728b28&req=cCcgH8p2lIhZFb4f3HP0gCG8tzarB9waXrozKJoV2M1A0alKeLlBczy7icH9%0AihhvG%2FF8NvEdGQHWXg%3D%3D%0A) - [SIRP Community](https://content.sirp.io/knowledge-base/sirp-community?hsLang=en) - [Playbook Guide](https://content.sirp.io/knowledge-base/playbook-guide?hsLang=en) - [User Guide](https://content.sirp.io/knowledge-base/user-guide?hsLang=en#main-content) - [IM Guide](https://content.sirp.io/knowledge-base/user-guide?hsLang=en#im-guide) - [Admin Guide](https://content.sirp.io/knowledge-base/admin-guide?hsLang=en) - [Integration Guide](https://content.sirp.io/knowledge-base/integration-guide?hsLang=en) - [Release Notes](https://content.sirp.io/knowledge-base/release-notes?hsLang=en) - [Add on Apps](https://content.sirp.io/knowledge-base/add-on-apps?hsLang=en) - [Architecture](https://content.sirp.io/knowledge-base/architecture?hsLang=en) - [Use Cases](https://content.sirp.io/knowledge-base/use-cases?hsLang=en) [![SIRP-Logo-4c-KO](https://content.sirp.io/hs-fs/hubfs/SIRP-Logo-4c-KO.png?width=200&height=90&name=SIRP-Logo-4c-KO.png "SIRP-Logo-4c-KO")](https://sirp.io) ### Global Headquarter ##### United States 7735 Old Georgetown Rd, Suite 510 Bethesda, MD 20814 [+1 888 701 9252](tel:+18887019252) [mailto:email@email.com](mailto:email@email.com) Copyright © 2025, SIRP Labs Inc